Tenant data isolation
A global query scope filters every tenant-scoped table automatically. Crossing it requires an explicit, audit-logged bypass — there's no accidental cross-tenant query.
Full activity logging
Every user action is recorded via a dedicated activity log, filterable and searchable.
Sensitive data flag
Platform-level and flagged private data is marked is_sensitive and gated behind a root-only permission — invisible even to a tenant's own superadmin.
Delegation can't escalate
A role can never be granted a permission its creator doesn't already hold — enforced server-side, not just hidden in the UI.
Rate limiting
Sensitive endpoints (login, OTP verification, form submissions) are throttled against abuse.
OWASP-conscious by default
CSRF protection, validated file uploads, and XSS-safe rendering throughout — admin-authored rich content is the one deliberate, documented exception.